This invention relates generally to multiple-redundant processing systems and, more particularly, to multiple-redundant processors employing voting logic. Triple-modular-redundant (TMR) computational systems have been known for some years. For example, U.S. Pat. No. 4,375,683 to Wensley, entitled "Fault Tolerant Computational System and Voter Circuit," describes such a system based on TMR architecture. In general, the principle of TMR systems is that the computation functions are performed by three identical modules operating in synchronism, and the results of the computations they perform are compared in a "voter" circuit. If one module is in error for some reason, its results are outvoted by the correct results from the other two modules.
The TMR principle is also described in a paper by Wakerley, "Microcomputer Reliability Improvement Using Triple Modular Redundancy," Proc. of the IEEE, Vol. 64, No. 6, June 1976. Another useful background paper is by Davies and Wakerley, entitled "Synchronization and Matching in Redundant Systems," IEEE Trans. on Computers, Vol. C-27, No. 6, June 1978.
The following patents are indicative of the state of the art in the field of the invention:
______________________________________ 3,356,837 Raymond Binary Data Information Handling System 3,501,743 Dryden Automatic Fault Correc- tion System for Parallel Signal Channels 3,538,498 Games et al. Majority Fault Selecting and Fault Indicating 3,665,173 Bouricius Triple Modular Redun- et al. dancy/Sparing 3,680,069 Neumann et al. Testing of Redundant Control Systems 3,783,250 Fletcher Adaptive Voting Computer et al. System 3,805,235 Foster et al. Equalization Means for Multi-Channel Redundant Control System 3,848,116 Moder et al. Data Processing System having Triplexed System Units 4,270,715 Norton et al. Railway Control Signal Interlocking Systems 4,356,546 Whiteside Fault-Tolerant Multi- et al. Computer System 4,402,045 Krol Multi-Processor Computer System 4,497,059 Smith Multi-Channel Redundant Processing Systems ______________________________________
The following patents are material to those aspects of the invention relating to removal and replacement of computation modules without disconnecting power from the entire system:
______________________________________ 3,993,935 Phillips et al. Printed Circuit Board Connection 4,079,440 Ohnuma et al. Printed Circuit Board Capable of Being Insert- ed and Withdrawn on On- line Status 4,454,552 Barnes et al. Printed Circuit Board Connection System ______________________________________
A common drawback in many fault-tolerant systems of the prior art, such as the system described in the Wensley patent (U.S. Pat. No. 4,375,683), is that the detection of faults within the system depends on there being a correct output from a voter circuit. If the voter circuit itself fails, the fault detection logic also fails. Other systems have employed multiple voter circuits in various configurations, to address this problem. However, none of the systems of the prior art is completely satisfactory in the area of detection of failures within the fault detection logic itself.
Accordingly, there is still a need for a multiple-redundant majority-voting system capable of detecting faults not only in multiple computation modules, but also in fault determination logic associated with each of the modules. The present invention is directed to this end.